Senior Security Researcher

Description

AI coding is the biggest enterprise AI use case today, shown by Anthropic's success with Claude Code, Cursor's $60B exit to SpaceX, and Cognition's $48B valuation.

The constraint has moved from writing code to securing it. AI agents produce code faster than teams can review it, more than 65% of the lines they generate are insecure, and vulnerabilities pile up 16x faster than companies can fix them. Attackers can exploit new flaws within hours.

The company's platform runs inside the environment where coding agents work, using hooks, skills and MCP, so controls sit outside the model and every agent action stays visible. Its patented code context graph maps code, open source, containers and infrastructure, shows which vulnerabilities can actually be reached and exploited, and delivers fixes that will not break the application. Security teams get evidence instead of noise, and developers get fixes instead of tickets.

Customers include OpenAI, SpaceX, DoorDash, Dropbox, Atlassian, MongoDB, Snowflake, Robinhood and Peloton.

The founder and CEO, Varun Badhwar, is on his third company. He built Prisma Cloud, which grew from $0 to $300M ARR at Palo Alto Networks. The company has raised $163M from Lightspeed, Coatue, DFJ Growth, Salesforce Ventures and Dell Technologies Capital.

Banking, hospitals, airports and power grids all run on software, and AI now writes a growing share of it. The company's aim is to make that software trustworthy.

The team is hiring a Senior Security Researcher for offensive research into software supply chain security, working at the front edge of secure SDLC. You will find zero-day vulnerabilities in software artifacts and CI/CD systems, analyse attack trends, and shape the next generation of the company's security capabilities.

The role calls for deep skills in vulnerability research, application security, reverse engineering and offensive techniques. The ideal candidate also publishes research through blogs, white papers and talks at major security conferences.

The company builds at the crossroads of developer productivity and security, one of the fastest-growing areas in software. Its developer-loved platform shows real ROI and momentum, and its customers care about doing things right. The team values ownership, decisions backed by data, candid feedback and celebrating wins.

Responsibilities

• Run offensive research on software supply chain threats, finding and analysing zero-day vulnerabilities.
• Build and refine exploit techniques that show how attackers reach the supply chain through malicious code, third-party libraries and CI/CD systems.
• Work with Product Management to turn research findings into security features in the company's products.
• Publish findings in technical blogs, white papers and major security conferences.
• Work with security engineers and developers to prototype and roll out detection and mitigation for new threats.
• Build open-source tools, methods or frameworks that strengthen software supply chain security.
• Track the latest threats, attacker methods and security trends to sharpen your research.

Requirements

• 5+ years in security research, vulnerability discovery and offensive security.
• Deep skills in reverse engineering, exploit development and software vulnerability analysis.
• Strong grasp of supply chain security, including package managers, CI/CD pipelines and dependency analysis.
• Has found zero-day flaws and reported them responsibly.
• Track record of publishing quality research or presenting at top conferences such as Black Hat, DEF CON, RSAC or BSides.
• Programming in Python, Rust or Go.
• Strong analytical skills and the ability to run complex security research on your own.
• Clear written and spoken communication that makes technical ideas understandable to varied audiences.

Conditions

The company is an Equal Opportunity Employer and encourages applicants who do not meet every requirement.